CVE-2024-27434

What it actually does

The iwlwifi driver incorrectly sets the MFP flag when installing a GTK protected with TKIP on an AP that advertises MFPC, sending an invalid cipher/MFP combination to firmware that triggers a crash.

Why it matters to the business

Wireless interfaces on affected Linux systems can crash under common enterprise or legacy Wi-Fi configurations, causing loss of network connectivity and requiring reboots or driver reloads.

How an attack unfolds

An attacker positions a wireless client against an access point configured with group cipher TKIP and MFPC enabled; when the client associates and the GTK is installed, the malformed MFP flag is passed to firmware, resulting in an immediate crash of the wireless stack.

How to fix it

Update the Linux kernel to a version containing commit b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8 or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8 via git log or package version; test association against a TKIP+MFPC AP and verify no firmware crash occurs.

Typical attack path

1. Identify or control an AP using TKIP group cipher with MFPC advertised
2. Force or wait for association of a vulnerable Linux client
3. Trigger GTK installation during the 4-way handshake
4. Observe firmware crash due to invalid MFP+TKIP combination

How to detect it

Review dmesg and kernel logs for iwlwifi firmware crash or assertion messages immediately after GTK installation; correlate with association events to TKIP networks.

What your security team should do

• Prioritize kernel updates on all systems using iwlwifi hardware
• Audit wireless configurations to disable TKIP where possible
• Monitor for wireless interface resets or firmware crashes after the fix is applied